Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Message to Our Customers

apple.com

Post reply on HN
Print view View original

341–350 of 1001 posts

Re: A Message to Our Customers

#341

Post by yoz-y »

GreaterFool wrote: post #59

This is interesting: "Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession." Am I reading this right? Apple, if they chose to, ca…

I think the important word missing in that phrase is "any _future_ iPhone".

For existing devices I imagine that a hypothetical iOSX which removes the protections would require you to enter your passcode so the OS can decrypt the data and then re-encrypt them using the new backdoored option.

Re: A Message to Our Customers

#342

Post by DannoHung »

Cook says any iOS device could be breached if this software were created. But other articles have led me to believe that any iOS model with touchid is immune due to the secure enclave being in play even for non-touch passcode access. Is this wrong?

Re: A Message to Our Customers

#343

Post by pweissbrod »

threatofrain wrote: post #175
epaga wrote: post #2

Huge props to Apple - here's hoping against hope that Google, Facebook, and Amazon get behind this. One thing I was wondering is how Apple is even able to create a backdoor. It is explained toward the end: "The government would have us remove security features and add new capabilities to the operating system, allowing a passcode to be input electronically. This would make it easier to unlock an iPhone by “brute force…

I'm afraid I'm too skeptical to get the same assurances as you. Apple accuses the FBI of playing language games with the term "backdoor", but I think Apple has done the same. The fact that they can push weak OS updates to a locked phone is the backdoor . This means that they can already comply with the court order, and they likely will. This letter covers them from PR damage.

+1. If it is possible to push software updates to a "locked" phone then is this not tantamount to remote code execution with root privileges, and hence the BACKDOOR ALREADY EXISTS?

"Locked" seems like an improper term for such a scenario.

I applaud apple for appealing this case to the public however there is a HUGE HUGE difference between "we can't unlock" and "we shouldn't unlock". This distinction will likely be lost on the general public unfortunately.

Re: A Message to Our Customers

#344

Post by OJFord »

0942v8653 wrote: post #334
bambax wrote: post #163

Earlier quoted context omitted.

I don't see how this "reassuring"; to me it's rather very confusing (as mentioned in many other comments). If Apple could in fact write a software backdoor, doesn't it mean that the backdoor exists, at least potentially? And how can one be sure that Apple is the only company able to build that door? At the very least, couldn't the right Apple engineer be either bribed or forced (by terrorists or the government) to bu…

It's not a backdoor, it's a frontdoor. In cryptography, there's no way to make repeated attempts more computationally expensive. The lockout just an extra feature Apple put on, that Apple could easily remove. If we're going to have 4- and 6- digit PINs, there is no way to stop a dedicated attacker frome brute-forcing it. None.

  > no way to stop a dedicated attacker from brute-forcing it
Wipe after x incorrect? Can't stop the attacker, but you can make it futile, surely.

Re: A Message to Our Customers

#345

Post by mmcconnell1618 »

ithkuil wrote: post #226
mjibson wrote: post #186

Earlier quoted context omitted.

I agree. I was under the impression that Apple's security was such that even they didn't have the power to decrypt a device because the crypto made it impossible without the password/pin/key. I'm interested to understand the reasons that it was not done this way.

The current implementation is done this way indeed: even Apple cannot decrypt without using the right password. The right password can be obtained by either knowing it, or by guessing it. As an additional security measure, the software shipped with the phone prevents brute force attacks by wiping the device after a given number of failed attempts. Apple has been asked to modify the software so that it won't wipe the…

Why doesn't the FBI simply clone the current device, make brute force attempts and then clone again if locked out? Yes, lots of work but also doesn't force Apple to participate.

Re: A Message to Our Customers

#346

Post by charlieegan3 »

0942v8653 wrote: post #334
bambax wrote: post #163

Earlier quoted context omitted.

I don't see how this "reassuring"; to me it's rather very confusing (as mentioned in many other comments). If Apple could in fact write a software backdoor, doesn't it mean that the backdoor exists, at least potentially? And how can one be sure that Apple is the only company able to build that door? At the very least, couldn't the right Apple engineer be either bribed or forced (by terrorists or the government) to bu…

It's not a backdoor, it's a frontdoor. In cryptography, there's no way to make repeated attempts more computationally expensive. The lockout just an extra feature Apple put on, that Apple could easily remove. If we're going to have 4- and 6- digit PINs, there is no way to stop a dedicated attacker frome brute-forcing it. None.

You can't make crypto behave slower on repeated attempts but you can still make each attempt more expensive. For example: https://en.m.wikipedia.org/wiki/Pepper_(cryptography)

Re: A Message to Our Customers

#347

Post by 0942v8653 »

OJFord wrote: post #344
0942v8653 wrote: post #334

Earlier quoted context omitted.

It's not a backdoor, it's a frontdoor. In cryptography, there's no way to make repeated attempts more computationally expensive. The lockout just an extra feature Apple put on, that Apple could easily remove. If we're going to have 4- and 6- digit PINs, there is no way to stop a dedicated attacker frome brute-forcing it. None.

> no way to stop a dedicated attacker from brute-forcing it Wipe after x incorrect? Can't stop the attacker, but you can make it futile, surely.

Nope. If the attacker (Apple in this case) can replace the OS, they will just do so before the phone gets wiped—replacing the OS will remove that wipe feature.

Re: A Message to Our Customers

#348

Post by lern_too_spel »

phkamp wrote: post #229

The fact that Apple indicates that they would be able to produce such a software version is in itself a backdoor in the iPhone.

Correct. What this letter says is that if Apple wants to get around the wipe restriction because they want the data themselves, they can do it. This means that they will build the backdoor as soon as they are legally compelled to, but in the meantime, they can use it for a PR stunt.

Re: A Message to Our Customers

#349

Post by nicky0 »

interpol_p wrote: post #266
robbiet480 wrote: post #63

Earlier quoted context omitted.

iPhone brute force hardware already exists [1]. The issue is that when Touch ID and/or a passcode is enabled, the device locks itself for a few seconds-a few hours every time an incorrect pin is entered. So brute forcing would take an extremely long time. In addition, there is a setting on all iPhones to erase data after 10 failed pin code entry attempts. The FBI wants Apple to provide a custom iOS build that can be…

But how can the custom iOS build be installed on the device while it is locked?

"The SIF will be loaded via Device Firmware Upgrade ("DFU") mode, recovery mode, or other applicable mode available to the FBI."

Re: A Message to Our Customers

#350

Post by junto »

legulere wrote: post #71
epaga wrote: post #2

Huge props to Apple - here's hoping against hope that Google, Facebook, and Amazon get behind this. One thing I was wondering is how Apple is even able to create a backdoor. It is explained toward the end: "The government would have us remove security features and add new capabilities to the operating system, allowing a passcode to be input electronically. This would make it easier to unlock an iPhone by “brute force…

Why wold Google and Facebook get behind this? They store their customers data in a way they can access and subsequently have to give it to persecuters when there's a court order

Was going to point out that you spelt "prosecutors"as "persecutors", but then realised you might have genuinely meant that spelling!
Post reply on HN